Access regression: students who previously logged in are now blocked (agujero negro / blocked-user landing) - PROD, real users

Sub-tickets

Questions

Activity

• wi-cli-venus created · 2026-06-12
• wi-cli-venus statusChanged · 2026-06-12
  Client report (WhatsApp via nw-whey 2026-06-12 ~13:24): students who PREVIOUSLY logged in are now BLOCKED - land on 'agujero negro' (blocked-user landing/login-error). 2 confirmed who had access + now don't. DISTINCT from ~10 students who NEVER entered (expected, not the bug). Regression. Dispatched coder-pluto-cc: investigate auth path (callback role resolution, getCurrentUser, allowlist, PLUTO-56 no-profile redirect 38b399a, deploy timeline incl 489109f). Hypothesis-to-CHECK (not assume): venus-Cele-class stale-JWT-vs-live-userRoles. Root cause before fix, NO row edits. Elazar steer: mine appEvents (incl info-level/category=toast) for the real signatures - db on it.
• wi-cli-venus note · 2026-06-12
  INVESTIGATION (coder+db, NO fix yet - blocked on victim emails from Elazar). appEvents 48h: only denials = loginDeniedNoProfile x2 (fernandapazsarligalvez@gmail.com Jun11, mila.odonto2802@gmail.com Jun10), both v1.67.22, NEITHER in users table. NOT a deploy regression: 0 userRoles soft-deleted/created 48h, 0 users soft-deleted today, 0 studentAssignments changed today -> shared-cause-with-70 REFUTED. appEvents clean 10h, others logging in (26 logins noon hr). loginDeniedNoProfile=authz=isCritical=ALWAYS persisted -> absence is real, denial branch not fired 10h. HYPOTHESIS: 2 victims have pre-existing bad authId state (never linked / authId-email mismatch); PLUTO-56 (38b399a) changed the SURFACE (no-profile now -> /solicitar-acceso agujero negro vs old red /login wall) so same long-standing denial reads as new lockout. Suspect: gmail dot/canonicalizeEmail mismatch (venus-Cele class). 2 emails -> 2-row query (authId/deletedAt/roles/canonical-vs-google-email) confirms/kills. Query staged.
• wi-cli-venus commented · 7w ago
  DISPATCHED 2026-06-26 (coder): investigate-and-report root cause FIRST (auth gate — no pre-committed fix). Check live userRoles gate vs frozen JWT claim, isAllowlistedEmail, canonical-email→authId binding asymmetry, isActive+deletedAt dual-deactivation. Audit pre-impl design-ping mandatory before fix. Queued after PLUTO-214 + PLUTO-192.
• wi-cli-venus commented · 7w ago
  CLOSED as NOT-A-BUG (coder diagnosis + audit independent live-DB verify, 2026-06-26). All 26 loginDeniedNoProfile emails classified: Puia's 7 failed-test soft-deletes (correct, never retried) + mila WI405-allowlist + alessio migration = intentional; 15 no-profile-ever = correct denial (provisioning gap, not auth bug); 7 self-healed on retry; 2 'still-blocked' (agusdiamante, veronica1994rios) = attempt-time data-state, NOT a code bug — agusdiamante's users row created 06-22 AFTER her 06-19 attempt; veronica's email changed 05-08 AFTER her 05-03 attempt (canonical mismatch at attempt). Both now authId NULL + deletedAt NULL + canon-match → self-heal on re-login. auth/callback gate behaved correctly at every event; 'first-SSO race' hypothesis unsupported (loginDeniedNoProfile is upstream of the link UPDATE). Remediation = re-login nudge to the 2 students, ZERO deploy, no row edit. Empty-provider-email hardening noted as optional separate defensive work.
• wi-cli-venus completed · 7w ago
  completed